home

firefox-13108-dp.exe

Internet installer

dobreprogramy sp. z o.o.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox-13108-dp.exe, “Internet installer Setup ” by dobreprogramy sp. z o.o has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Web Installer generic   (signed by dobreprogramy sp. z o.o.)

Product:
Internet installer

Description:
Internet installer Setup

MD5:
b360a4a1e526fa93f6758139dd8197d3

SHA-1:
9af3787b83adff929c1e1713dfcc9225b1f91c77

SHA-256:
ecb42d99bb9ffad9bf16294993cb6feefd3ddb5e26d26ada2174a69e7153c678

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/30/2024 9:09:53 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.dobreprogramyspzoo.Installer (M)
16.1.8.16

File size:
846.4 KB (866,744 bytes)

Product version:
2.0.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\firefox-13108-dp.exe

Digital Signature
Signed by:
dobreprogramy sp. z o.o.

Authority:
thawte, Inc.

Valid from:
2/25/2015 12:00:00 AM

Valid to:
2/25/2016 11:59:59 PM

Subject:
CN=dobreprogramy sp. z o.o., OU=IT, O=dobreprogramy sp. z o.o., L=Wroclaw, S=Dolnoslaskie, C=PL

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
04CCACE3AEB4566AFA610407D3C9D967

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:/EIue+LAYj8URLR+lhbRCUKwSsid8GVMdvBGx8NTWC:/TyLAYrRLWRCUBSBVMdvh6C

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 8 URLs.

http://cdn.perkyfilesqueue.com/c?x=iwlEf7XAMP1/WmeG3Nm0WB3hnliqJX39ZC7eRwSo0Bs=&c=VQ7q4wkns2qMANaQUbCodmK0QSLPg0Hk693zKHYRGrdrCQVlmfogt/v/Sug2Rw XdANStuU/nod1AUkXgmBMs1mu/HcaPQ7JWXBiY7/LdE7IGQnGCH552mdqgGFZ6Kx8xQoMI2HwrYm8Ot7K38Ok9w==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/40.0.3/win32/.../Firefox Setup 40.0.3.exe&downloadAs=Firefox-13108-dp.exe

http://cdn.perkyfilesqueue.com/c?x=7RvuvHR38jhPIewscFvXhwAaDxe8SOOeSB9r2fxwyRQ=&c=M7m DLccAa5S345Fzeeid6JqfKefmWvsP3P3Pk4l0wjNPa5 Qja0vD40U22ZGIhkwtXJ3uPy D03f2A6FyCIRQCigoI/vy Wt4ztNOEg2l1vE5Es3c/ywfpa05Y9zWWH36zGaD7btIWeqKoaT5nF4w==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/40.0.3/win32/.../Firefox Setup 40.0.3.exe&downloadAs=Firefox-13108-dp.exe

http://cdn.dobreprogramyplfactorybinaries.com/c?x=J0pm5SHuzoqCNGkMlppnNQOBy5vrFTl5WnhUOgONaoM=&c=yPoyMhaqrUGLq8GcLF5w8q7xqCw0adqnEaOZ45Do0kmEgpFcpVu1w1VF1TU3MnUETcDMMu9VZIScSiCgmFQVX6NXslJeIDBrmdJHr3hgQJS2LnWPGjZRWLH/C9W64nioQ1h /50k8OHHD7LV jXAAhAwftpCZJak2GjLYSw4rgw=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/40.0.3/win32/.../Firefox Setup 40.0.3.exe&downloadAs=Firefox-13108-dp.exe

http://www.dobreprogramyplcentraltoday.com/c?x=MqfHb/iEaT8s7zbthldBD2fN0fsEcH5cwIa2EVEgXm0=&c=anZJorzH9Hpior6wWzcdfLF1zF3pj j4k3VFG1UG9ONZl1vmaa0Qd/mOLWPnITkuPsSLTYix4lvtdQn7lZxgZMjyvTAOn7ygaHc0WHoyiqf9978FTw7zuESuuBXYeSCst3Fwz Bmez3blq2Uiih8e9LkTJ6dG1uvpSbMdg6uWDM=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/40.0.3/win32/.../Firefox Setup 40.0.3.exe&downloadAs=Firefox-13108-dp.exe

http://cdn.dobreprogramypltourcontent.com/c?x=uPR Beiy49D9fB2rwIXDeO9SqknWn9GOtH8pGDNAyk4=&c=3gSYsW9AlU69pyO0JIygrPQZU9dRJkerOBZxraA8VR/OtczETjRsiUaYWX0Qh8xPc87Y9ya2XIIbl5Aqw8lVCJHBdQNtMUDdtp5NohavtC9Gu0DLwlKWyU3lhVJ7Gohaus15sKBCQMBDyCRuDqmlBwQLFiBjiGrsrlaUKC11QgA=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/40.0.3/win32/.../Firefox Setup 40.0.3.exe&downloadAs=Firefox-13108-dp.exe

http://cdn.dobreprogramypltourcontent.com/c?x=jSCkCJDoa3PMxSs1RnOK6AX6G/6Qh394TzWnUIpOvZE=&c=5C6NsOcYHOwhN7ru6mwBxGRO0tS49QXwJBlbPivBgNpmf2SuWxfGMqhMQHBziPCuLf8Mx1479s69 YrVLKfW0BOxOxJB0xweoCpeMX3ldnB3P5O2x CESHRrVQCnhR3J2fIHC9 mrbjxeN N1o5fDM/CNVINxhPHo0y9htzNSN0=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/40.0.3/win32/.../Firefox Setup 40.0.3.exe&downloadAs=Firefox-13108-dp.exe

http://cdn.dobreprogramypltourcontent.com/c?x=d1M7D q3SejkUUJuUXVszsYo9MDI9QAP7S6IIvMYV9k=&c=CKm3gXIlWsOWOhgrvq1fXNS11thlsJ3bHnENiEqpadpLM/jMKz6ghYI9HrHf84wk5dSa4EO3EuL6qHhT91ETOCSVTzL98zkWH8gfigaj0jyuX5ehNBO2stGtv1w8Nh9RmQlTjCPzspUzNWXEbZYwWJRw6D9vrMq6hEVRJI9NgiA=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/40.0.3/win32/.../Firefox Setup 40.0.3.exe&downloadAs=Firefox-13108-dp.exe

http://cdn.dobreprogramypltourcontent.com/c?x=WR7tTIdxHO4HSNUEFreS8OdE uLODH8GS3Fj5t0DCm8=&c=KXgVKzlBzGQoCvRkjhVrkKnauDkfUsY5ReFO8uIIJKfasPAeDFYsdEFkvdcbLsN9cHgN0CM4uRhD IutMIMQ7fdmm6ewVCGPsUC2EIiwoY6on0s9vwu55RfYhDH4sHceu Zv9rdJVEPEvofOo9Jial0sZ4YCDkJ AR7hMI3Ad8U=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/40.0.3/win32/.../Firefox Setup 40.0.3.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.